ARCADIA-Studio/harness/release-source-alias-rename-validation-20260912.md

# Text alias rename — branch validation

Codex-9e8r6t `/root`, Windows, 2026-09-12. This records **uncommitted branch work**
over `be7a8cd8d7d63aa18e0196bbd36f9e646764c761`; it is not an integrated release
or native acceptance claim. [Issue 9](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/9)
owns the current task. The [design](release-source-alias-rename-design-20260911.md)
and [transaction critique](release-source-alias-rename-transaction-critique-20260911.md)
define the intended behavior and evaluators. Linux/WSL remains user-paused.

## Verification method

Root coordinates one Windows compiler job. The local toolchain environment is
`.local/toolchain/env.ps1`; `CARGO_BUILD_JOBS=1`. Commands use `--locked --offline`
and the Windows GNU LLVM development profile. The attempt helper
`.local/source-rename-integration-20260912/gate.py` preserves each attempt in an
exclusive directory, including raw input ZIP, complete scoped file membership,
per-file hashes, compiler/environment records, raw logs and stage receipts.
It verifies the same file membership and bytes before and after each command.
Its scopes include the workspace manifests, crates, build support, Cargo config,
documentation, examples and harness fixtures. These private evidence directories
are not yet published artifacts; preserve them until final evidence packaging.

The serial gates are strict Clippy for all desktop targets, the complete desktop
binary test suite, an explicit ignored representative timing experiment and
the matching desktop build. Attempts 1–5 ran tests before Clippy; attempt 6
moves Clippy first to catch lint failures before the longer suite. A failed
stage stops the attempt. Native checks
use a separately identified executable only after these gates pass.

## Earlier findings and verified results

The isolated Document/query trial initially omitted `build/windows_manifest.rs`
from its reconstruction and failed before tests. Its corrected `v2` capture
passed 8 alias-transaction, 13 existing Document and 20 query tests, finishing
at 11:20:55 UTC. This establishes those isolated seams only. The combined
`cargo check --locked --offline -p oa-desktop --tests` subsequently passed;
unused preview range accessors were removed after its warning.

Attempt 1 failed compilation on two mounted-test calls that attempted mutable
widget operations through `as_widget()`. Correcting those test calls to
`as_widget_mut()` allowed execution. Attempt 2 passed 791 tests, failed one and
ignored two. Its sole failure used an invalid property-field key, `name` instead
of `/name`, so it had never created the intended dirty draft. The fixture was
corrected and strengthened to assert retention of the exact `/name` draft value.
Neither finding justified a production behavior change.

Attempt 3 passed **792 tests, zero failed, two ignored**, finishing at
11:49:39.273922 UTC (165.53 seconds of test execution). Its captured inputs
remained unchanged. Raw stdout SHA-256:
`392379b23ca446ad1d617da25c640f2911a9ab643fd61d6b8fc15a72d346f92b`;
stderr: `f5b640295276418cb45226fe82f3dfdfe5f7ee018c1777516784f80d562620a3`.
The subsequent strict Clippy stage stopped on five diagnostics: a collapsible
search conditional, two constant platform/profile assertions in the timing
experiment, a test-case type-complexity diagnostic and field reassignment after
`Default` in a query test. The correction uses a let-chain, scopes the manual
timing module to Windows debug tests, names the case type and initializes the
query limit directly. The platform-specific experiment does not prevent other
platforms or release profiles from compiling their applicable tests.

No timing or desktop-build stage ran in attempts 1–3. Passing attempt 3 does not
cover the subsequent paste guard described below.

Attempt 4 passed 792 tests, failed the newly added normal-paste assertion and
ignored two, finishing at 12:03:16.113761 UTC (167.39 seconds of test execution).
The rejection cases reached their expected outcomes before the normal-paste
case failed. The attempt's captured inputs remained unchanged; no subsequent
gate ran. Its stdout SHA-256 is
`62cc9471678fabe08fc32db0e46665f1b9babd1d70f814371995c96a6b5de430`.
Root and the implementation owner independently traced the failure to the test
fixture: Iced calls the test operation's selection callback before its focus
callback, and `focus()` moves the cursor to the end. Thus the fixture erased its
own selection before pasting. The correction must focus and select separately,
assert a real nonempty selection and retain the exact replacement oracle. This
is an evaluator defect, not a reason to change valid-paste production behavior.

## Clipboard finding and correction

Root inspected the actual dependency source, Iced `iced_widget` 0.14.2
`src/text_input.rs`, whose paste path filters `char::is_control` before invoking
either input callback. Consequently, a pasted `foo\nbar` could silently become
the valid alias `foobar`. Merely validating the callback value or adding an
`on_paste` callback would miss the original input. This contradicted the
design's prohibition on silent replacement normalization.

The alias field now has a narrow widget adapter that checks the actual paste
shortcut before the child input handles it. It rejects the whole paste if it
contains control characters, retaining field text and selection, displaying
feedback and invalidating the previous preview approval and pending intent.
An occupied worker remains occupied until its matching completion. Permitted
first-paste input uses one captured clipboard value passed to the child; normal
Iced editing, focus and key-repeat behavior remain with the child widget.
No dependency, vendor or cached Iced source was changed.

Mounted evaluator cases cover newline, tab, CRLF and NUL refusal; unchanged
selection through feedback/rebuild; normal valid paste; exactly one actual
clipboard read; and refusal of an old confirmation. Independent review checks
the wrapper against the cached Iced implementation, with particular attention
to stored modifiers, focus, pending workers and repeated paste.

That review found another production counterexample: the wrapper initially
reset its modifier state on `KeyPressed.key == Escape`, whereas the child uses
its effective dispatch, including `modified_key` and earlier shortcut returns.
For `key=Escape, modified_key=Home`, the wrapper could clear Command while the
child retained it, allowing a following paste to bypass rejection. The
correction observes the child's actual focused-to-unfocused transition after
forwarding a key press instead of guessing its dispatch. Mounted tests must
exercise mismatched key fields, pending worker retention and the relevant
focus/enabled/modifier conditions. Held-key paste may reuse the child's earlier
admitted cache; the single-read claim applies to fresh clipboard reads.

The final bounded static review found no remaining concrete paste defect and
bound the corrected adapter, wrapper tests and controller tests to exact hashes
in `.local/source-rename-controller-independent-review-20260912/paste-resolution-bindings.json`.
The focused `source_rename::` run then passed **32 tests, zero failed, one
ignored**, finishing at 12:08:16.497392 UTC (3.20 seconds of test execution).
This includes the actual-selection correction, valid paste, the 20-condition
focus/enabled/modifier matrix, divergent key fields, held-key cache release and
pending-worker rejection. Raw logs and the command receipt are retained under
`.local/source-rename-integration-20260912/focused-paste-v2`.

## Remaining acceptance

Attempt 5 passed the full desktop suite: **796 passed, zero failed, two
ignored**, finishing at 12:11:20.769886 UTC (147.44 seconds of execution).
Inputs remained unchanged. Stdout SHA-256:
`38e9413b678de73fdc1e277be5313193002c81326f32e29bafdd4e45701fe322`;
stderr: `43c2d65557dd4392177fcb91e097ca375acfc796928e92a51b129c69892fb66d`.
Its Clippy stage subsequently found a preview helper used only by tests and an
obsolete `expect(dead_code)` on the now-used authored identity accessor. The
helper is now test-only and the obsolete expectation removed. Attempt 5 stopped
at 12:12:23.924779 UTC without timing/build execution; its Clippy stderr SHA-256
is `87a4858cf1d4116b1938268db07095c17b301e64a1e115f42a4020da633ea58f`.
Before attempt 6 the edited guide and generated HTML were aligned to the
repository's LF policy; no frozen evidence or fixture bytes were normalized.
Attempt 6 captures these final inputs, with lint first. The native launch
helper checks this same required gate order; its behavior otherwise remains
the independently reviewed launch protocol.

Attempt 6 passed strict all-target Clippy at 12:14:39.585030 UTC, then the
full suite (**796 passed, zero failed, two ignored**) at 12:18:12.718483 UTC
(172.07 seconds of test execution). The explicit timing experiment also passed
its complete-model/source/identity/history assertions at 12:18:36.171758 UTC.
All three stages verified unchanged captured inputs. The desktop build also
passed at 12:21:39.274814 UTC. Its preserved executable is 113,854,464 bytes,
SHA-256 `d1ec63050e95513064155e9d04f443d95667b1e468dcdbb3b810dad379504814`.
The 513-file raw input ZIP SHA-256 is
`03b5a9e3f4e9e220421320c09f1ecf46f811edf2e3c6c45dcd9522c6d78b8255`.
All four gates verified unchanged captured membership and bytes.

For the 30-file, 78,414-byte, 258-identity walkthrough, five measured Windows
debug trials after one warmup reported these median/range values in milliseconds:

| Phase | Median | Min–max |
| --- | ---: | ---: |
| Mint Document request | 0.092 | 0.052–0.170 |
| Worker Document preparation | 282.259 | 165.302–298.259 |
| Worker preview and origin | 13.429 | 10.763–23.969 |
| Guarded Document commit | 0.0109 | 0.0082–0.0229 |
| Application synchronization | 495.499 | 472.030–610.017 |
| Actual Confirm update | 571.893 | 433.909–1122.241 |

The phases and full Confirm use separate fresh fixtures with alternating trial
order; their values must not be added or subtracted as simultaneous timings.
Task polling, layout, GPU work and first paint are excluded. Fast snapshot
adoption does **not** establish a responsive UI: application refresh still takes
roughly half a second in these samples. Native assessment and a discriminating
refresh-phase diagnosis are needed before making a responsiveness claim. The
timing log SHA-256 is
`a063b67755b972e7f0b6a42c4af7fb9e1a41ecbda9775e1f40b031b8dd0c9a5c`.

Native fixtures in `.local/source-rename-native-20260912` preserve
independent baseline/work/expected trees for a four-source project and the
30-source engineering walkthrough. Their expected edits were authored by
literal role-specific replacements, preserving every physical supporting file.
Preparation-only oracle passes do not establish future GUI correctness.

Native acceptance must inspect complete preview access, focus and bounded
layout, cancellation, confirmation, model Undo/Redo, Save and reopen, comparing
the full saved Project, identities and source bytes against the authored oracle.
The reviewed launch helper preserves the identified executable and runtime,
uses a private profile and retains the child process handle until exit to record
the actual exit code and final logs.

## First native transaction trial and blocking findings

The identified attempt-6 executable ran in a private profile as PID 9108 from
12:22:14 UTC, with actual process exit zero recorded at 12:45:42.336483 UTC.
Both logs were empty; the executable and runtime DLL remained unchanged.
The private profile initially lacked a Desktop directory, causing a file-picker
notice. Creating that private directory resolved the harness setup issue.

The four-source Unicode-path project exercised F2 on the typed reference,
invalid alias feedback, Enter to preview, Enter again without confirmation,
both changed-file previews, minimum 1100×700 client layout, Escape cancellation,
explicit confirmation, Save, persistent model Undo/Save, Redo/Save and reopen.
The new alias was selected at the original typed reference after confirmation;
the same spelling in prose remained unchanged. Reopen showed the expected
`assess_damage` alias. Five independent saved-disk oracle runs passed: cancelled
baseline, renamed save, undone save, redone save and reopened result. Each
compared the complete Project, identities and all four exact physical files.
The representative 30-source native workflow and immediate Undo Rename button
were not exercised in this trial.

Native preview acceptance **failed**: screenshot
`trial-attempt-6/screenshots/032-simple-preview-minimum-bottom-0.jpg` shows the
final brace of the longer After declaration occluded by the vertical scrollbar.
Independent image/source review confirmed default Shrink width and a floating
scrollbar, plus inadequate wrapping for unbroken fragments. Byte-complete
preview indexes and rectangle-only layout checks did not catch this defect.
The correction must reserve scrollbar space, wrap unbroken fragments, and add
actual shaped-glyph/paint visibility checks before a new native trial.

Publication also needs byte-reproducible source. The provenance review verified
all 513 captured files but identified 13 Git-clean baseline files whose live
CRLF bytes differ from the LF bytes in HEAD. These are strict newline-only
differences, distinct from intentional alias changes. After closing the native
trial, root verified each current hash, Git-clean status and strict newline-only
equivalence, then aligned exactly those 13 ordinary files with their HEAD LF
bytes. The receipt is `aligned-reviewed-lf.json` in the integration evidence
directory. New checks/builds use new captures; attempt-6 and all earlier raw
archives remain unchanged and bound to their original bytes.

The new real-paragraph visibility evaluator compiled against the **old** layout
and failed as intended at 12:57:38.285740 UTC. It identified the exact native
declaration's final brace (UTF-8 cluster 92–93) at x591.398 with width6.598,
crossing the actual scrollbar boundary x587.996. Captured inputs remained
unchanged. This is a demonstrated regression falsifier, not a passing gate.
Receipt/logs: `clipping-negative-1` in the integration evidence directory;
stderr SHA-256 `2ac214f31252edeef4f33b64a46b11fb42dbf0c04848d38bb8730978d9d5ce10`.
The reviewed correction fills the preview width, reserves the scrollbar's
actual width plus spacing, and uses glyph-fallback wrapping. It leaves source
indexing and the transaction unchanged. A positive check is separate.

The corrected layout then passed all **33 focused rename tests**, zero failed,
one ignored, at 13:05:52.950223 UTC (11.89 seconds of test execution).
That capture included disabled-by-default temporary timing instrumentation;
the geometry and transaction tests did not enable it. Inputs remained unchanged.
Stdout SHA-256 `307bd915536983fc19102fcff39535df950cee06841d968f5be2092c091ccc76`.

The independently reviewed nested diagnostic subsequently passed the existing
full Project/source/identity/history/origin assertions in all warmup and measured
trials, finishing at 13:07:20.854282 UTC. It measured the same real Confirm
message path, with fixed-capacity timestamps enabled only around direct sync
or Confirm. In the whole-Confirm arm, five measured samples gave these medians:
actual update **1039.0 ms**, source Content assignment **996.7 ms** (814.4–1182.2),
validation **26.4 ms**, property refresh **6.3 ms**, and Workspace acceptance
**0.28 ms**. Each nested phase belongs to that same arm; earlier runs have
different absolute timings and are not a paired performance comparison.
Source Content assignment includes construction and destruction of the previous
editor. Layout, highlighting during draw and native paint remain excluded.
The raw log SHA-256 is
`a98877362ca52a024942803e0ab698a1fd84703d4512fcf7137c147a28817039`.
The temporary instrumentation was removed afterwards, restoring both exact
production baselines before implementing any candidate.

This evidence justifies a bounded display-refresh experiment: retain the laid-out
editor and apply complete, preflighted same-line changes only after the existing
Document commit succeeds. Every ordinary synchronization step remains shared;
incompatible line endings, stale display bytes or a failed exact final readback
fall back to reconstruction from accepted source. A review found that deleting
an entire line body could introduce a greedy LFCR boundary; both before and after
preflight now refuse that representation. The candidate resets highlighting from
line zero without changing text, and restores the same approved origin. It passed
`cargo check --locked --offline -p oa-desktop --tests` at 13:25:02.235871 UTC,
with unchanged captured inputs. Execution, first subsequent layout/highlighting
cost, native behavior and final gates remain separate acceptance requirements.

The user's new [Text UX issue 13](http://217.177.34.108:3000/sorokin.oleg.edu/ARCADIA-Studio/issues/13)
also rules out adding permanent command clutter. The new separate Undo Rename
row has been removed; the existing model Undo control uses the guarded rename
action while it remains available. Broader compact-editor work is owned in that
issue and is not claimed complete by this local adjustment.

The completed native trial is preserved in the
[attempt-6 evidence archive](experiments/source-alias-rename-native-20260912/source-rename-native-attempt-6-20260912.zip),
with [archive receipt](experiments/source-alias-rename-native-20260912/archive-result.json)
and [independent verification](experiments/source-alias-rename-native-20260912/review.md).
Its 284 members occupy 3,221,627 compressed bytes; SHA-256
`77adda5a33eb1def6dab23352ca0ab172300ea65fc21d2c215d545d7fcce0d08`.
The archive retains all original captures, complete fixture trees, five saved
verification receipts, helper sources and clean-exit logs; executable/DLL bytes
are externally hash-bound. The gate inputs and provenance evidence are preserved
separately below. This archive describes the first trial only; later corrections
and execution do not turn its clipping failure into a passing native result.

## Corrected editor refresh execution

The next-layout evaluator initially failed to compile because its new focus call
lacked Iced's `Focusable` trait import. The failed `editor-patch-tests-1` capture
is preserved unchanged; no runtime result is claimed for it. After adding that
test-only import, `editor-patch-tests-2` passed **38 focused tests**, zero failed,
two ignored, at 13:51:44.023824 UTC. This includes exact editor text and line
endings, the LFCR refusal, retained-tree highlighter reset, real Confirm/history
checks and normal synchronization fallback. All captured inputs stayed unchanged.
Stdout SHA-256: `a25dd49c669c09936d1da7ddeba4f7d3d6b6a918b72cd39dde4df6f75d201344`.

On the same source, `editor-patch-timing-1` passed both ignored experiments at
13:54:04.503303 UTC. The real App Confirm update had median **46.0 ms**
(23.0–206.1 ms, five measured samples); ordinary `app_sync` deliberately retains
the reconstruction path and is not the same operation. The paired editor trial
used one warmup and five alternating fresh trials per arm, the 29,506-byte
traceability source, a retained widget tree, a 640×350 viewport, 14px monospace
font and 16px padding. Replacement plus next layout plus draw/highlighting had
median **35.5 ms** with reuse (13.6–73.4), versus **2782.7 ms** with reconstruction
(2697.7–3994.6). Exact source/line-ending/cursor checks and accepted alias
attributes, shaped glyph colors and visible glyph bounds passed after every arm.
This measures real text layout and highlighting, but excludes GPU/native paint
and is not an end-to-end production latency guarantee. Source inputs stayed
unchanged; stdout SHA-256:
`ae8d57e0d65084d71d92815c093607c7cd4d9d9166c562cec33a061b2fcba74c`.

Independent static review of the App seam found no actionable defect: commit
authority, ordinary synchronization order, fallback, metadata, histories and
guarded reveal remain intact. Native focus/reveal, the next text edit, corrected
preview rendering and full gates still require their own evidence.

The earlier completed gates and experiments are preserved separately in the
[historical evidence archive](experiments/source-alias-rename-completed-20260912/source-rename-completed-evidence-20260912.zip)
with its [independent review](experiments/source-alias-rename-completed-20260912/independent-review.md).
All 77 members, five nested source archives, eight receipt/log pairs and 73
original readbacks passed verification. ZIP SHA-256:
`2282e4e755bb03ab3ecb079391909f3978297ad307e76306ef7eb5a87a9437cf`.
That archive intentionally ends at the earlier check-only candidate; the newer
focused execution and timing captures are separate.

## Full corrected Windows gates

Attempt 7 completed unchanged at **14:15:41.805763 UTC**: strict desktop Clippy
with all targets and `-D warnings`, **802 desktop tests passed** (zero failed,
three ignored), the required isolated Confirm experiment passed, and the GUI
build passed. The repeated Confirm median was 71.9 ms (43.2–101.8); the separate
paired layout experiment above remains the rendering-cost evidence. Formatting
of all changed/new Rust files passed with `rustfmt --edition 2024 --check
--config skip_children=true`; `git diff --check` also passed.

The identified GUI is 113,879,552 bytes, SHA-256
`2486eecc00d8de9160ecd930f69394e00b1a1ce102d76fb776b978db33414ed3`,
built with the Windows GNU LLVM development profile, no optimization/debuginfo,
and debug assertions enabled. All 516 captured input files match the preceding
focused test and paired timing inputs byte for byte.

[Corrected refresh evidence](experiments/source-alias-rename-refresh-20260912/source-rename-refresh-evidence-20260912.zip)
preserves those three complete captures, receipts, raw logs and independent App
and execution reviews. Its [independent archive review](experiments/source-alias-rename-refresh-20260912/independent-review.md)
verified all 37 members, three nested source snapshots, six command receipts
and original bindings. ZIP SHA-256:
`d46aacbba1dfccec64b195482e2857c97ceefecad6b0176c62c73c50964e18ba`.
This is a source-verification checkpoint, not a released or fully native-accepted
milestone. The corrected native trial is separate and must retain its actual
workflow coverage and limitations.

## Closed native trial on dfb6102

The corrected trial used the identified GUI above and source commit
`dfb6102ba5aec9e26a48cc5472b51a4b349459fd`. Its original 516 build inputs were
verified against the raw committed blobs. The native process closed normally
with exit code 0 at **22:20:26.337292 UTC**; stdout and stderr were empty, and
the executable and runtime DLL remained unchanged. The long interruption between
the afternoon and evening captures is not a responsiveness measurement.

Both the four-file Unicode fixture and the representative 30-source fixture
passed explicit rename, restoration of the selected original reference, the
first subsequent text edit, Text Undo, Save, whole-model Undo/Redo and native
reopen. Eight saved-state checks passed complete model, identity and reachable
source equality plus every physical file: four in the small fixture and 37 in
the representative fixture, including support files. Confirm alone left the
saved baseline unchanged. These oracles inspect saved disk state; they do not
independently inspect unsaved GUI memory.

At the minimum 1100-by-700 client size, the previously clipped declaration brace
and all six changed lines in the larger fixture were readable. Native multiline
paste after a valid preview explicitly rejected the whole paste, retained the
alias, removed the preview and disabled confirmation. Re-entering a valid alias
required fresh Preview. This caret-only trial does not prove selection-range
preservation during rejection; the separately executed mounted tests cover it.

Two recoverable usability findings remain separate from transaction correctness:
preview page/file changes retain the previous vertical scroll position, and an
OS system-menu sizing sequence invalidated an apparently valid alias field.
The latter's exact input bytes and event cause remain unproven. No accidental
confirmation or model/source corruption was observed. A subsequent scroll
correction requires its own source-bound tests and native evidence; this trial
does not verify later code.

The [closed native archive](experiments/source-alias-rename-native-closure-20260912/source-rename-native-closure-20260912.zip)
and [independent review](experiments/source-alias-rename-native-closure-20260912/independent-review.md)
preserve and verify all 355 members, 351 original readbacks, eight oracle receipts,
the final 41 physical files and 516 raw committed build inputs. ZIP SHA-256:
`abff68aeb2bd893577d4226c9ec4b6b0823b4ec22895a273ab2d22f344354207`;
size 6,449,971 bytes. Screenshot 023's unrelated occluding window image is
excluded; its hash and exclusion reason are retained. This remains a prerelease
preparation checkpoint, not full OA/SA acceptance. Linux verification remains
paused by the user.